Security & Trust

Last Updated: October 8, 2026

This page describes the security architecture, controls, and practices of the QuikForms managed package for Salesforce and of the one service QuikForms, LLC operates, the QuikForms AI gateway. It describes the product as it is built and is not a contractual commitment or warranty; the commitments are in the Terms of Service and the Data Processing Agreement.

Questions about anything on this page can be sent to info@sfquikforms.com.

Architecture Overview

Diagrams of every component, data flow, and trust boundary, with the authentication used at each one, are on the Architecture and Data Flow page.

Your Data Stays in Your Org

QuikForms does not operate servers or databases that store customer data. When a form is submitted, the data is written directly to Salesforce objects in your org. File uploads and signatures are stored as Salesforce Files (ContentVersion records) or, for an attachment field, as Attachment records in your org. Analytics, exception logs, AI conversation history, and configuration also stay in your org.

This architecture means:

• You keep control of your data.
• Your Salesforce security controls (profiles, permission sets, sharing rules, field-level security, and encryption) apply to it.
• Data residency for form data is determined by your Salesforce instance. AI requests are the exception: they are processed by Anthropic in the United States, as described below.
• You can delete any QuikForms data with standard Salesforce tools.
• QuikForms has no standing access to your org or the data in it. For a support request, an administrator in your org can grant QuikForms time-limited login access through Salesforce and revoke it at any time. QuikForms uses that access only for that request. The package sends no usage data to QuikForms.

How It Works

Visitor's Browser
        |
        v
Your Salesforce Site or Experience Cloud site (your org)
        |
        v
QuikForms form service (Apex in your org, as the site guest user)
  |-- Checks the referrer allowlist and rate limit
  |-- Verifies CAPTCHA (Cloudflare Turnstile)
  |-- Validates every value on the server
  |-- Writes only fields the form shows and the guest may create
  |-- Creates records in YOUR Salesforce objects
        |
        v
Your Salesforce Data (Cases, Leads, Contacts, Custom Objects)

The only external call the package makes during a form submission is the Cloudflare Turnstile verification. It sends the CAPTCHA token and your Turnstile secret key, not your form data or the visitor's IP address. The visitor's browser loads the Turnstile widget from Cloudflare, so Cloudflare does receive the visitor's IP address from the browser. Plugins you write run your own code and make whatever calls you program.

AI Features and the AI Gateway

Every QuikForms plan includes QuikForms AI. AI features are separate from form submission: they run only when a signed-in QuikForms administrator starts one, and an administrator can switch them off for the whole org (the AI_Enabled__c setting), in which case no AI request is made.

• QuikForms AI included in your plan (the default): your org calls the QuikForms AI gateway (https://ai-gateway.sfquikforms.com) through a Salesforce Named Credential. The gateway is a Cloudflare Worker that QuikForms operates on Cloudflare's network. It authenticates your org with a per-tenant token held in a Salesforce External Credential in your org, checks your monthly allowance, and forwards the request to Anthropic under QuikForms' account. Anthropic processes it in a QuikForms workspace that also serves other customers with the same kind of subscription (trial or paid). The gateway authenticates, meters, and limits your org separately, by its own token, and returns each response only to the org that sent the request. When the allowance is used up, the gateway refuses AI requests until the next period; nothing else in QuikForms is affected.
• Your own Anthropic API key: your org calls Anthropic's API (https://api.anthropic.com) directly. The gateway is not involved, QuikForms does not meter the requests, and Anthropic bills you for them.
• No content stored or logged: the gateway never stores or logs prompts or responses, at any log level, and an automated check on every change to its code enforces this. Its logs hold operational metadata only (such as the tenant or org identifier, event, status, token counts, and duration), which Cloudflare retains for 7 days. It stores no form data and no records from your org.
• Tokens: the gateway keeps a SHA-256 hash of each tenant token, not the token. The only exception is the one-time activation step, when the token waits at the gateway until your org collects it, for at most 12 hours.
• No training: data sent through Anthropic's commercial API is not used to train Anthropic's models. Anthropic retains and deletes it under its commercial terms and data retention policies.
• Forms do not depend on it: forms, submissions, file uploads, and analytics keep working if the gateway or Anthropic is unavailable.

AI features send form configuration, Salesforce schema metadata, the administrator's own messages, aggregate analytics counts, and exception logs an administrator selects. They do not send form submission values, records, uploads, survey answers, chat data, or IP addresses, except that an exception log's text can quote a value someone entered. The full list is in the Data Processing Agreement. AI output can be wrong, so forms, validation patterns, and translations generated with AI should be reviewed before they are published.

Managed Package Protection

QuikForms is a Salesforce managed package (namespace: quikforms). The Apex code in a managed package is hidden from subscribers, and subscribers cannot modify the package's components. Package versions are distributed only through Salesforce.

Bot Protection & Abuse Prevention

Cloudflare Turnstile CAPTCHA

QuikForms uses Cloudflare Turnstile to check that a submission comes from a person.

• Server-side verification: tokens are verified on the server through a Named Credential callout to Cloudflare. If Cloudflare cannot be reached, the submission is refused rather than accepted unverified.
• Isolated frame: the Turnstile widget loads in a separate frame, never directly in the form page.
• Configurable per form: theme, size, and interaction mode are configurable, and CAPTCHA can be switched off for a form.

Honeypot Fields

Every form includes a hidden field that people do not see but automated scripts tend to fill in. It is enabled by default. A submission that fills it in goes through the same checks as any other, then receives a decoy success response instead of being saved: no record is written, and no plugin, Flow, or platform event runs.

Rate Limiting

Submissions are limited per IP address per minute (20 by default, configurable), using Salesforce Platform Cache with the IP address hashed in the cache key. The limit also covers chat fallback records and plugin callouts. If Platform Cache is unavailable, the limit fails open so that legitimate visitors are not blocked, and the degradation is logged.

Input Validation

Control	Description
Required fields	Enforced on the server regardless of what the browser sends. Fields hidden by a dependency rule are exempt.
Pattern validation	A field's validation pattern (regular expression) is applied on the server.
Choice validation	A submitted choice must be one of the options the form offers.
Permitted objects	A form can write only to the objects its published configuration names.
Forbidden objects	A fixed list blocks writes to sensitive objects (for example User, Profile, PermissionSet, Organization, ApexClass, NamedCredential, and QuikForms' own configuration and log objects), whatever the configuration says.
File uploads	Size limits, an allowlist of file types, and a check for executable file signatures.

Data Protection & Privacy

IP Address Hashing

To count unique visitors, analytics store an HMAC-SHA256 hash of the visitor's IP address and the date, keyed with a random secret held in a protected setting in your org. Because the date is part of the hashed value, the same address produces a different hash each day, and because the hash is keyed, the address cannot be recovered by trying every possible address. Analytics do not store the raw IP address.

The raw IP address is stored or passed on only in these cases:

• on the created record, when an administrator turns on Log_User_Browser_Info__c for a form and the target object has the QuikForms tracking fields (off by default);
• in the QuikForms_Submission_Complete__e and QuikForms_Validation_Failed__e platform events (Professional), for your own automation, only when Log_User_Browser_Info__c is on for the form (otherwise the events' User_IP__c field is blank);
• to plugins and Flow hooks you install (Professional), as part of the request information; and
• in API exception logs, when the log level is set to Debug.

Sensitive Data Filtering in Logs

Before an exception log is written, values in its context data whose keys contain any of these terms (case-insensitive) are replaced with ***REDACTED***: password, pwd, passwd, apikey, api_key, token, secret, secretkey, ssn, social_security, cardnumber, cvv, ccn, and creditcard. Error messages and stack traces are not filtered, and an error message can quote a value someone entered.

Field-Level Security & CRUD Enforcement

• Administrative and AI features query data in user mode (WITH USER_MODE), so they see only what the signed-in user may see.
• Public form submissions run in a controlled system-mode path that writes only to permitted objects and only the fields the form shows, after checking that the site guest user may create the object and each field.
• The guest user's create access comes from a permission set in your org that the Setup Assistant's form-access sync builds from your live forms.

Access Control

Referrer Verification

An administrator can list the website hosts allowed to send submissions (Valid_Referrers__c, comma-separated). When the list is set, a submission from any other page is refused with an "Unauthorized Origin" error and the attempt is logged. When it is blank, any page may submit.

Guest User Permissions

Object	Create	Read	Edit	Delete
Form configuration objects	No	No (read by package code)	No	No
Objects your live forms write to	Yes	Yes	No	No
Exception log objects	No	No	No	No

The packaged guest permission set grants access to the package's public pages and classes and no object permissions. Exception logs are written by package code and need no guest permission.

Preview Tokens

A preview of an unpublished form version requires a signed preview token issued to an administrator. Without one, a visitor sees only the published version.

Monitoring & Logging

Exception Logging

Centralized exception logging captures errors from Apex, Lightning Web Components, the REST API, forms, plugins, and settings changes, with structured error codes (such as APEX-, LWC-, API-, FORM-, and PLUGIN-), a severity (Critical, High, Medium, Low, or Info), stack traces, transaction IDs, and governor limit snapshots.

Configurable Log Levels

The Exception_Log_Level__c setting controls what is recorded. The default is Error.

Level	What Gets Logged
Debug	Everything
Info	Critical, High, Medium, Info
Warning	Critical, High, Medium
Error	Critical, High
Critical	Critical only
None	Logging disabled

Platform Events (Professional)

• QuikForms_Submission_Complete__e: published after every successful submission.
• QuikForms_Validation_Failed__e: published when a submitted value fails server-side validation.

Data Retention

Data Type	Default	Configuration Setting	Cleanup
Analytics records	365 days	Analytics_Retention_Days__c	Automatic
Exception logs	30 days	Exception_Log_Retention_Days__c	Automatic
AI conversation history	90 days	AI_Chat_Retention_Days__c	Automatic
Survey links	Valid for 30 days	Valid_Survey_Days__c	Link expires; survey records are customer-managed
Form submission records	Indefinite	N/A (standard Salesforce data)	Customer-managed

Automatic cleanup runs during normal use of the package, at most about once an hour, with no scheduled job to set up.

Salesforce Platform Security

Salesforce Certifications

Form data is stored on the Salesforce Platform, which Salesforce operates under its own compliance program. Salesforce reports, among others:

• SOC 1 and SOC 2 Type II audits;
• ISO 27001, ISO 27017, and ISO 27018 certifications; and
• FedRAMP authorization for Salesforce Government Cloud.

These certifications belong to Salesforce and cover Salesforce's services. QuikForms, LLC holds no certifications of its own. Visit trust.salesforce.com for Salesforce's current list.

Platform Security Controls

Control	Description
Encryption at rest	Provided by Salesforce. Salesforce Shield Platform Encryption adds customer-managed keys.
Encryption in transit	TLS for all traffic to Salesforce, the AI gateway, Cloudflare, and Anthropic.
Authentication	Salesforce multi-factor authentication, single sign-on, and session management for administrators.
Audit trail	Salesforce Setup Audit Trail records administrative changes.
Event monitoring	Salesforce Shield Event Monitoring provides detailed activity logs.

AppExchange Security Review

Salesforce requires every package listed on the AppExchange to pass its AppExchange security review, which includes automated code scanning, manual review, CRUD and FLS checks, and a review of every external callout. QuikForms will be listed on the AppExchange only after it passes that review.

OWASP Top 10 Coverage

#	OWASP Risk	QuikForms Controls
A01	Broken Access Control	Object and field create checks; permitted and forbidden object lists; referrer verification; signed preview tokens; a guest permission set with no object permissions.
A02	Cryptographic Failures	Keyed HMAC-SHA256 IP hashing; TLS in transit; Salesforce encryption at rest; Named and External Credentials for secrets; the AI gateway keeps only a SHA-256 hash of each tenant token after activation.
A03	Injection	Bind variables in SOQL; server-side input validation; HTML that administrators add is sanitized with DOMPurify, and scripts are removed.
A04	Insecure Design	Defense in depth (honeypot, CAPTCHA, rate limiting, and validation); decoy responses to honeypot catches; sensitive data filtering in logs.
A05	Security Misconfiguration	Secure defaults (honeypot on, CAPTCHA on, IP hashing, raw IP logging off); a fixed forbidden objects list that configuration cannot override.
A06	Vulnerable Components	Managed package updates through Salesforce. One bundled third-party library: DOMPurify (HTML sanitizer), unmodified and kept current. Cloudflare Turnstile loads from Cloudflare, only in an isolated frame on public form pages.
A07	Auth Failures	Salesforce authentication for administrators; Turnstile for public forms; signed preview tokens; expiring survey links.
A08	Integrity Failures	Managed package code cannot be modified by subscribers; package versions are distributed only through Salesforce; field mappings come from server-side configuration, not request input.
A09	Logging Failures	Centralized logging with structured error codes; configurable severity; platform events; referrer and rate limit logging.
A10	SSRF	Each external callout uses a Named Credential with a fixed endpoint: Cloudflare Turnstile for form submissions, and the QuikForms AI gateway or Anthropic's API for administrator-initiated AI features. The destination is fixed in metadata, never taken from request input. A plugin you write makes the callouts your own Apex defines.

Compliance

GDPR Readiness

• Data minimization: IP addresses are hashed for analytics, and raw IP logging is off unless an administrator turns it on.
• Right to erasure: all QuikForms data is in your Salesforce org and can be deleted with standard tools.
• Data portability: submissions are stored in standard Salesforce objects and can be exported with Salesforce tools.
• Configurable retention: analytics, log, and AI conversation retention periods are configurable.
• Data Processing Agreement: see the DPA.
• Roles: you are the controller of the personal data your forms collect. QuikForms acts as your processor for the limited processing described in the DPA.

CCPA / CPRA Readiness

• No sale or sharing: QuikForms does not sell or share personal information, or use it for advertising or profiling.
• Access and deletion: all data is in your Salesforce org, under your direct control.
• Sensitive personal information: sensitive keys are filtered from log context data.

SOC 2

QuikForms, LLC does not have a SOC 2 report of its own. Form data, analytics, and configuration are stored on the Salesforce Platform, which Salesforce has audited under SOC 2 Type II. The one service QuikForms operates is the QuikForms AI gateway on Cloudflare's Workers platform, which carries requests from AI features that use the QuikForms AI included in a plan and does not store their content.

Sub-processors

Salesforce, Inc. (the platform your org runs on); Cloudflare, Inc. (Turnstile, and hosting of the QuikForms AI gateway); and Anthropic PBC (the model behind QuikForms AI). Payments for subscriptions are processed by Stripe through Salesforce's AppExchange Checkout and involve no form data. Details, and how QuikForms gives notice of a new sub-processor, are in the Data Processing Agreement.

Security Incident Notification

If QuikForms becomes aware of a personal data breach affecting data it processes for you, it will notify you without undue delay and within 72 hours, as set out in the Data Processing Agreement. Because form data is stored in your Salesforce org, incidents on the Salesforce Platform are reported by Salesforce under your agreement with Salesforce. If you suspect a security problem with QuikForms in your org, email info@sfquikforms.com.

Responsible Disclosure

How to Report

If you believe you have found a security vulnerability in QuikForms, email info@sfquikforms.com with the subject line "Security Report" and include:

• a description of the vulnerability and its potential impact;
• steps to reproduce it;
• any proof-of-concept code or screenshots; and
• your contact information (optional).

Scope

In scope: the QuikForms managed package, installed in a Salesforce org or sandbox that you own or are authorized to test; the QuikForms AI gateway at ai-gateway.sfquikforms.com; and the website at www.sfquikforms.com. Out of scope: Salesforce, Cloudflare, and Anthropic services themselves, which have their own reporting programs; forms or orgs belonging to other people; denial-of-service testing; social engineering; and physical attacks.

Guidelines

• Test only against orgs and accounts you own or are authorized to test.
• Do not access, modify, or delete data that belongs to others, and stop and report as soon as you encounter any.
• Do not degrade service for others, and do not use automated scanning against the AI gateway at a volume that affects it.
• Do not attempt to use another organization's AI allowance or tenant token.
• Give QuikForms a reasonable time to fix the issue before disclosing it publicly.

What to Expect

QuikForms will acknowledge your report within two (2) business days, investigate and assess its severity, keep you informed as it works to fix confirmed vulnerabilities, and, with your permission, credit you.

Safe Harbor

QuikForms will not pursue legal action against, or ask law enforcement to investigate, anyone who researches and reports a vulnerability in good faith and in line with these guidelines. QuikForms considers such research authorized for the purposes of its own Terms of Service and Acceptable Use Policy. This does not authorize testing of Salesforce, Cloudflare, or Anthropic systems, or of any org you do not own or have permission to test.

Frequently Asked Questions

Does QuikForms store my form data on your servers?
No. All form submission data is stored in your Salesforce org.

What external services does QuikForms connect to?
Form submissions call one external service: Cloudflare Turnstile, for CAPTCHA verification, which receives the verification token from your org and loads its widget in the visitor's browser. AI features, when an administrator uses them, call Anthropic: through the QuikForms AI gateway when they use the QuikForms AI included in your plan, or directly when you use your own Anthropic API key. AI features send form configuration and other administrator-side data, not form submissions; the DPA lists exactly what is sent. The in-app documentation loads from www.sfquikforms.com in the administrator's browser and receives no data from your org.

Can QuikForms employees access my data?
Not by default. QuikForms has no standing access to your Salesforce org or the data in it. For a support request, an administrator in your org can grant QuikForms time-limited login access through Salesforce and can revoke it at any time. QuikForms uses that access only to work on that request.

Is QuikForms HIPAA compliant?
QuikForms runs on Salesforce, which offers configurations for HIPAA workloads under an agreement with Salesforce. Whether your deployment meets HIPAA requirements depends on your Salesforce configuration and agreements. AI features send administrator-side data to Anthropic, not form submissions, but an exception log an administrator selects for AI explanation can quote a value someone entered. Contact us before collecting protected health information with QuikForms.

Can I turn off analytics?
Yes. The Analytics_Enabled__c setting turns analytics off for the whole org, and each form has its own analytics setting.

Can I turn off AI?
Yes. The AI_Enabled__c setting turns every AI feature off for the whole org.

Does QuikForms support Salesforce Shield encryption?
Yes. QuikForms stores data in Salesforce objects in your org, so Shield Platform Encryption can be applied to it as to any other Salesforce data.

Contact

Email: info@sfquikforms.com
Website: www.sfquikforms.com

This page describes the security controls in the QuikForms managed package and the QuikForms AI gateway as of October 7, 2026. It is provided for information and is not a contractual commitment or warranty.